<?xml version="1.0" encoding="utf-8"?>
<xs:schema id="ServiceDefinitionSchema"
    targetNamespace="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceDefinition"
    elementFormDefault="qualified"
    xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceDefinition"
    xmlns:mstns="http://tempuri.org/XMLSchema.xsd"
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    version ="1.0"
>
  <xs:complexType name="LocalStore">
    <xs:annotation>
      <xs:documentation>
        Configuration of a local storage resource
      </xs:documentation>
    </xs:annotation>
    <xs:attribute name="name" use="required" type="NamedElementNameString">
      <xs:annotation>
        <xs:documentation>
          The name of the resource. This is used by the role's code to map to a directory in the local file system.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="sizeInMB" use="optional" type="xs:int">
      <xs:annotation>
        <xs:documentation>
          The desired storage space (in MB)
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="cleanOnRoleRecycle" use="optional" type="xs:boolean" default="true">
      <xs:annotation>
        <xs:documentation>
          Deletes the contents of the local storage on role recycle.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="ConfigurationSetting">
    <xs:annotation>
      <xs:documentation>
        A configuration setting is the mapping of a name to a string value. The name of the setting is
        declared here and the mapping to a value is set in the service configuration file.
      </xs:documentation>
    </xs:annotation>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the configuration setting.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="Certificate">
    <xs:annotation>
      <xs:documentation>
        A certificate setting is the mapping of a named  certificate to its destination.
        The mapping from the name of the certificate to the actual certificate is defined in the service configuration file.
      </xs:documentation>
    </xs:annotation>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the certificate.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="storeLocation" type="StoreLocation" use="required">
      <xs:annotation>
        <xs:documentation>
          The location of the store where the certificate needs to be deployed.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="storeName" type="StoreName" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the store where the certificate needs to be deployed.
          Either built in stores like My (for Personal), Root(for Trusted Root CA), CA (for Intermediate CA), Trust (for Enterprise Trust)
          or a custom certificate store
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="permissionLevel" type="PermissionLevel" default="limitedOrElevated">
      <xs:annotation>
        <xs:documentation>
          Set this to elevated to retrict access to elevated exceutionContext startup or runtime process to access the private key.
          Set this to limitedOrElevated to allow both limited and elevated executionContext startup or runtime processes to access the private key
          Default value is limitedOrElevated which is backwards compatible.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:simpleType name="StoreLocation">
    <xs:restriction base="xs:string">
      <xs:enumeration value="CurrentUser" >
        <xs:annotation>
          <xs:documentation>
            To install to the users certificate stores
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="LocalMachine" >
        <xs:annotation>
          <xs:documentation>
            To install to the machines certificate stores
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="RoleSize">
    <xs:restriction base="xs:string">
      <xs:enumeration value="ExtraSmall"/>
      <xs:enumeration value="Small" />
      <xs:enumeration value="Medium" />
      <xs:enumeration value="Large" />
      <xs:enumeration value="ExtraLarge" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="StoreName">
    <xs:union memberTypes="BuiltinStoreName NonEmptyString"/>
  </xs:simpleType>

  <xs:simpleType name="AnyPort">
    <xs:restriction base="xs:string">
      <xs:enumeration value="*" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="PortSpecifier">
    <xs:annotation>
      <xs:documentation>
        Port specifier can be an integer or '*' to represent an automatically allocated port
      </xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort AnyPort"/>
  </xs:simpleType>

  <xs:simpleType name="BuiltinStoreName">
    <xs:restriction base="xs:string">
      <xs:enumeration value="My" >
        <xs:annotation>
          <xs:documentation>
            Personal certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="Root" >
        <xs:annotation>
          <xs:documentation>
            Trusted Root Certificate Authorities certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="CA" >
        <xs:annotation>
          <xs:documentation>
            Intermediate Certificate Authorities certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="Trust" >
        <xs:annotation>
          <xs:documentation>
            Enterprise Trust List certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="Disallowed" >
        <xs:annotation>
          <xs:documentation>
            Untrusted Certificates
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="TrustedPeople" >
        <xs:annotation>
          <xs:documentation>
            Trusted People certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="TrustedPublisher" >
        <xs:annotation>
          <xs:documentation>
            Trusted Publishers certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="AuthRoot" >
        <xs:annotation>
          <xs:documentation>
            Third-party certificate authorities certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="AddressBook" >
        <xs:annotation>
          <xs:documentation>
            Other people certificate store
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="Certificates">
    <xs:annotation>
      <xs:documentation>
        Declaration of all certificates that need to be deployed.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Certificate" type="Certificate" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="Endpoints">
    <xs:annotation>
      <xs:documentation>
        Defines a collection of endpoints.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:element name="InputEndpoint" type="InputEndpoint" minOccurs="0" maxOccurs="unbounded"/>
      <xs:element name="InternalEndpoint" type="InternalEndpoint" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="ConfigurationSettings">
    <xs:annotation>
      <xs:documentation>
        Configuration settings are deployment-specific mappings of names to string values that can be
        accessed from the role's code. The names of the settings are declared here and the mappings to
        values is done in the service configuration file.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Setting" type="ConfigurationSetting" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="WebRole">
    <xs:annotation>
      <xs:documentation>
        The configuration of the web role which accepts external requests.
      </xs:documentation>
    </xs:annotation>
    <xs:all>
      <xs:element name="Imports" type="Imports" minOccurs="0" maxOccurs="1" />
      <xs:element name="Startup" type="Startup" minOccurs="0" maxOccurs="1" />
      <xs:element name="LocalStorage" type="LocalStore" minOccurs="0" maxOccurs="1" />
      <xs:element name="LocalResources" type="LocalResources" minOccurs="0" maxOccurs="1" />
      <xs:element name="ConfigurationSettings" type="ConfigurationSettings" minOccurs="0" maxOccurs="1"/>
      <xs:element name="InputEndpoints" minOccurs="0" maxOccurs="1">
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>
              A set of endpoints that can be exposed by the service.
            </xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="2">
            <xs:element name="InputEndpoint">
              <xs:annotation>
                <xs:documentation>
                  An endpoint of a service specifies the transport protocol and port on which the service receives requests.
                </xs:documentation>
              </xs:annotation>
              <xs:complexType>
                <xs:complexContent>
                  <xs:restriction base="InputEndpoint">
                    <xs:attribute name="protocol" use="required" >
                      <xs:simpleType>
                        <xs:restriction base="Protocol">
                          <xs:enumeration value="http" />
                          <xs:enumeration value="https" />
                        </xs:restriction>
                      </xs:simpleType>
                    </xs:attribute>
                  </xs:restriction>
                </xs:complexContent>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="InternalEndpoint" minOccurs="0" maxOccurs="1">
        <xs:complexType>
          <xs:complexContent>
            <xs:restriction base="InternalEndpoint">
              <xs:attribute name="protocol" use="required" >
                <xs:simpleType>
                  <xs:restriction base="InternalProtocol">
                    <xs:enumeration value="http" />
                  </xs:restriction>
                </xs:simpleType>
              </xs:attribute>
            </xs:restriction>
          </xs:complexContent>
        </xs:complexType>
      </xs:element>
      <xs:element name="Endpoints" type="Endpoints" minOccurs="0" maxOccurs="1"/>
      <xs:element name="Certificates" type="Certificates" minOccurs="0" maxOccurs="1" />
      <xs:element name="Sites" type="Sites" minOccurs="0" maxOccurs="1" />
      <xs:element name="Runtime" minOccurs="0" maxOccurs="1" type="Runtime"/>
    </xs:all>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the role. Each role should have a unique name.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="enableNativeCodeExecution" type="xs:boolean" default="true">
      <xs:annotation>
        <xs:documentation>
          Allow the execution of native x64 code in this role. Also enables full trust managed code.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="vmsize" type="RoleSize" default="Small">
      <xs:annotation>
        <xs:documentation>
          The size of the VM needed to host this role.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="WorkerRole">
    <xs:annotation>
      <xs:documentation>
        Configuration for optional process role of service.
      </xs:documentation>
    </xs:annotation>
    <xs:all>
      <xs:element name="Imports" type="Imports" minOccurs="0" maxOccurs="1" />
      <xs:element name="Startup" type="Startup" minOccurs="0" maxOccurs="1" />
      <xs:element name="LocalStorage" type="LocalStore" minOccurs="0" maxOccurs="1" />
      <xs:element name="LocalResources" type="LocalResources" minOccurs="0" maxOccurs="1" />
      <xs:element name="ConfigurationSettings" type="ConfigurationSettings" minOccurs="0" maxOccurs="1"/>
      <xs:element name="Endpoints" type="Endpoints" minOccurs="0" maxOccurs="1"/>
      <xs:element name="Certificates" type="Certificates" minOccurs="0" maxOccurs="1" />
      <xs:element name="Runtime" minOccurs="0" maxOccurs="1" type="Runtime"/>
    </xs:all>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the role. Each role should have a unique name.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="enableNativeCodeExecution" type="xs:boolean" default="true">
      <xs:annotation>
        <xs:documentation>
          Allow the execution of native x64 code in this role. Also enables full trust managed code.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="vmsize" type="RoleSize" default="Small">
      <xs:annotation>
        <xs:documentation>
          The size of the VM needed to host this role.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="VirtualMachineRole">
    <xs:annotation>
      <xs:documentation>
        Configuration for Virtual Machine based roles of a service.
      </xs:documentation>
    </xs:annotation>
    <xs:all>
      <xs:element name="Imports" type="Imports" minOccurs="0" maxOccurs="1" />
      <xs:element name="ConfigurationSettings" type="ConfigurationSettings" minOccurs="0" maxOccurs="1"/>
      <xs:element name="Endpoints" type="Endpoints" minOccurs="0" maxOccurs="1"/>
      <xs:element name="Certificates" type="Certificates" minOccurs="0" maxOccurs="1" />
      <xs:element name="LocalResources" minOccurs="0" maxOccurs="1">
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>
              A set of local storage resources that can be defined for the service.
            </xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="0" maxOccurs="unbounded">
            <xs:element name="LocalStorage">
              <xs:complexType>
                <xs:annotation>
                  <xs:documentation>
                    Configuration of a local storage resource for a Virtual Machine Role.
                  </xs:documentation>
                </xs:annotation>
                <xs:attribute name="name" use="required" type="NamedElementNameString">
                  <xs:annotation>
                    <xs:documentation>
                      The name of the resource. This is used by the role's code to map to a directory in the local file system.
                    </xs:documentation>
                  </xs:annotation>
                </xs:attribute>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
    </xs:all>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the role. Each role should have a unique name.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="vmsize" type="RoleSize" default="Small">
      <xs:annotation>
        <xs:documentation>
          The size of the VM needed to host this role.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:simpleType name="Protocol">
    <xs:restriction base="xs:string">
      <xs:enumeration value="http"/>
      <xs:enumeration value="https" />
      <xs:enumeration value="tcp" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="InternalProtocol">
    <xs:restriction base="xs:string">
      <xs:enumeration value="http"/>
      <xs:enumeration value="tcp"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="InputEndpoint">
    <xs:annotation>
      <xs:documentation>
        An endpoint of a service specifies the transport protocol and port on which the service receives requests.
      </xs:documentation>
    </xs:annotation>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the endpoint.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="protocol" type="Protocol" use="required"/>
    <xs:attribute name="port"  type="xs:int" use="required" />
    <xs:attribute name="certificate" type="NamedElementNameString">
      <xs:annotation>
        <xs:documentation>
          The name of the certificate for use with https endpoints.
          The store location and store names for https configuration is automatic and need not be defined.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="localPort" type="PortSpecifier" use="optional">
      <xs:annotation>
        <xs:documentation>
          Optional specifier to control the assignement of the local port used for a loadbalanced endpoint.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="ignoreRoleInstanceStatus" type="xs:boolean" use="optional" default="false">
      <xs:annotation>
        <xs:documentation>
          Set this value to true to ensure a load balanced endpoint is always available regardless of
          the role instance status. The default value is false.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="InputEndpoints" >
    <xs:annotation>
      <xs:documentation>
        A set of endpoints that can be exposed by the service.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:element name="InputEndpoint" type="InputEndpoint"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="InternalEndpoint">
    <xs:annotation>
      <xs:documentation>
        An endpoint of a role that can be used for inter role communication. It specifies the transport protocol, 
        and optional a set of fixed port ranges that can be used to communicate to the endpoint.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>
          The collection of fixed port ranges.
        </xs:documentation>
      </xs:annotation>
      <xs:element name="FixedPort" type="Port" minOccurs="0" maxOccurs="unbounded"/>
      <xs:element name="FixedPortRange" type="PortRange" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the endpoint
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="port" type="PortSpecifier" use="optional">
      <xs:annotation>
        <xs:documentation>
          Optional specifier to control the assignement of the port used for the internal endpoint.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="protocol" use="required" type="InternalProtocol">
      <xs:annotation>
        <xs:documentation>
          The protocol of the endpoint
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>
  
  <xs:complexType name="InternalEndpoints" >
    <xs:annotation>
      <xs:documentation>
        A set of internal endpoints that can be used for inter-role communication by the service.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:element name="InternalEndpoint" type="InternalEndpoint"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="ServiceDefinition">
    <xs:annotation>
      <xs:documentation>
        The description of a Utility Computing Service.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:sequence minOccurs="1" maxOccurs="unbounded">
        <xs:element name="WebRole" type="WebRole" minOccurs="0" maxOccurs="unbounded" />
        <xs:element name="WorkerRole" type="WorkerRole" minOccurs="0" maxOccurs="unbounded" />
        <xs:element name="VirtualMachineRole" type="VirtualMachineRole" minOccurs="0" maxOccurs="unbounded" />
      </xs:sequence>
      <xs:element name="NetworkTrafficRules" minOccurs="0" maxOccurs="1" type="NetworkTrafficRules"/>
    </xs:sequence>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the service.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="upgradeDomainCount" type="xs:positiveInteger" use="optional">
      <xs:annotation>
        <xs:documentation>
          The number of upgrade domains for each role in this service.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="LocalResources">
    <xs:annotation>
      <xs:documentation>
        A set of local storage resources that can be defined for the service.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:element name="LocalStorage" type="LocalStore" />
    </xs:sequence>
  </xs:complexType>
 
  <xs:complexType name="Sites">
    <xs:annotation>
      <xs:documentation>
        A set of IIS7 sites associted with a Web Role
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:element name="Site" type="Site" />
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="Site">
    <xs:annotation>
    <xs:documentation>
      Defintion of a single IIS7 site associted with a Web Role
    </xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="VirtualDirectory">
        <xs:sequence>
          <xs:element name="Bindings" type="Bindings"  />
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>

  <xs:complexType name="Bindings">
    <xs:annotation>
      <xs:documentation>
        
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Binding" type="Binding" minOccurs="1" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="Binding">
    <xs:annotation>
      <xs:documentation>
        A site uses a list of bindings
      </xs:documentation>
    </xs:annotation>
    <xs:attribute name="name" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the binding.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="endpointName" type="NamedElementNameString" use="required">
      <xs:annotation>
        <xs:documentation>
          The name of the endpooint on the Web Role
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="hostHeader" type="xs:string" use="optional">
      <xs:annotation>
        <xs:documentation>
          Host name used, if any.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="VirtualDirectory">
    <xs:sequence>
      <xs:choice minOccurs="0" maxOccurs="unbounded">
        <xs:element name="VirtualDirectory" type="VirtualDirectory" />
        <xs:element name="VirtualApplication" type="VirtualDirectory" />
      </xs:choice>
    </xs:sequence>
    <xs:attribute name="name" type="VirtualDirectoryName" use="required" >
      <xs:annotation>
        <xs:documentation>
          The name which is reflected in the virtual path
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="physicalDirectory" type="xs:string" use="optional">
      <xs:annotation>
        <xs:documentation>
          Location of the physical directory, can also be specified during packaging. 
          A relative path is assumed to be relative to the location of the csdef.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType> 

  <xs:complexType name="VirtualApplication">
    <xs:complexContent>
      <xs:extension base="VirtualDirectory">
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>

  <xs:simpleType name="VirtualDirectoryName">
    <xs:restriction base="xs:string">
      <xs:pattern value="^[a-zA-Z_][^\\/\?;:\`\'\^@&amp;=\+\$,\|&quot;&lt;&gt;]*(?&lt;![\.\s])$" />
    </xs:restriction>
  </xs:simpleType>
  
  <!-- 
  Allows a string which starts with alphabets or underscore, followed by any number of character
  except ^ \ / : * ? ' < > |. And it should not end in whitespace.
  -->
  <xs:simpleType name="NamedElementNameString">
    <xs:restriction base="xs:string">
      <xs:pattern value="^[a-zA-Z_][^\\\/\:\*\?\&quot;\&lt;\&gt;\|\`\'\^]*(?&lt;![\.\s])$" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="NonEmptyString">
    <xs:restriction base="xs:string">
      <xs:minLength value="1"/>
      <xs:maxLength value="256"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="MatchMode">
    <xs:restriction base="xs:string">
      <xs:enumeration value="AnyRule"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="RoleEndpoint">
    <xs:attribute name="roleName" type="NamedElementNameString" use="required" />
    <xs:attribute name="endpointName" type="NamedElementNameString" use="required" />
  </xs:complexType>

  <xs:complexType name="Port">
    <xs:attribute name="port" type="xs:unsignedShort" use="required" />
  </xs:complexType>

  <xs:complexType name="PortRange">
    <xs:attribute name="min" type="xs:unsignedShort" use="required" />
    <xs:attribute name="max" type="xs:unsignedShort" use="required" />
  </xs:complexType>

  <xs:complexType name="FromRole">
    <xs:attribute name="roleName" type="NamedElementNameString" use="required" />
  </xs:complexType>

  <xs:complexType name="Destinations">
    <xs:sequence minOccurs="1" maxOccurs="unbounded">
      <xs:element name="RoleEndpoint" type="RoleEndpoint"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="WhenSource">
    <xs:sequence  minOccurs="0" maxOccurs="unbounded">
      <xs:element name="FromRole" type="FromRole" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
    <xs:attribute name="matches" type="MatchMode" use="required" />
  </xs:complexType>

  <xs:complexType name ="AllowAllTraffic">
  </xs:complexType>

  <xs:complexType name="OnlyAllowTrafficTo">
    <xs:annotation>
      <xs:documentation>
        Rule that allow the service to restrict traffic between roles
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Destinations" type="Destinations"/>
      <xs:choice>
        <xs:element name="AllowAllTraffic" type="AllowAllTraffic" />
        <xs:element name="WhenSource" type="WhenSource"/>
      </xs:choice>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="NetworkTrafficRules">
    <xs:annotation>
      <xs:documentation>
        Definiton of rules that allow the control of interrole traffic.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="OnlyAllowTrafficTo" type="OnlyAllowTrafficTo" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:simpleType name="TaskType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="simple" />
      <xs:enumeration value="foreground" />
      <xs:enumeration value="background" />
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="Variable">
    <xs:attribute name="name" type="NonEmptyString" use="required" />
    <xs:attribute name="value" type="xs:string" use="required" />
  </xs:complexType>

  <xs:complexType name="Environment">
    <xs:sequence>
      <xs:element name="Variable" type="Variable" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="Task">
    <xs:all>
      <xs:element name="Environment" type="Environment" minOccurs="0" maxOccurs="1"/>
    </xs:all>
    <xs:attribute name="commandLine" type="NonEmptyString" use="required" />
    <xs:attribute name="executionContext" type="ExecutionContext" use="optional" default="limited" />
    <xs:attribute name="taskType" type="TaskType" use="optional" default="simple" />
  </xs:complexType>

  <xs:simpleType name="ExecutionContext">
    <xs:restriction base="xs:string">
      <xs:enumeration value="limited"/>
      <xs:enumeration value="elevated"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="PermissionLevel">
    <xs:restriction base="xs:string">
      <xs:enumeration value="limitedOrElevated">
        <xs:annotation>
          <xs:documentation>
            Specifies that both elevated and limited startup tasks and runtime processes can access this resource.
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="elevated">
        <xs:annotation>
          <xs:documentation>
            Specifies that only elevated startup tasks and runtime processes can access this resource.
          </xs:documentation>
        </xs:annotation>
      </xs:enumeration>
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="Startup">
    <xs:annotation>
      <xs:documentation>
        A sequence of startups
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Task" type="Task" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
    <xs:attribute name="priority" use="optional" type="xs:int" default="0">
      <xs:annotation>
        <xs:documentation>
          Optional attribute that defines which sequence of startup tasks runs first when there
          are multipule startup sections defined within a single because of role modules.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>
  
  <xs:complexType name="Import">
      <xs:attribute name="moduleName" type="NamedElementNameString">
        <xs:annotation>
          <xs:documentation>
            The name of the module to include.
          </xs:documentation>
        </xs:annotation>
      </xs:attribute>
  </xs:complexType>
  
  <xs:complexType name="Imports">
    <xs:annotation>
      <xs:documentation>
        A set of role modules to be included in this role.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0" maxOccurs="unbounded">
      <xs:element name="Import" type="Import" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="Runtime">
    <xs:annotation>
      <xs:documentation>
        Controls the runtime environment of the Windows Azure host process.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Environment" type="Environment" minOccurs="0" maxOccurs="1" />
    </xs:sequence>
    <xs:attribute name="executionContext" type="ExecutionContext" use="optional" default="limited"/>
  </xs:complexType>

  <xs:complexType name="RuntimeForRoleModule">
    <xs:annotation>
      <xs:documentation>
        Controls the runtime environment of the Windows Azure host process.
      </xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:restriction base="Runtime">
        <xs:sequence>
          <xs:element name="Environment" type="Environment" minOccurs="0" maxOccurs="1" />
        </xs:sequence>
        <xs:attribute
          name="executionContext"
          type="ExecutionContext"
          use="prohibited"/>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>
  
  <xs:complexType name="RoleModule">
    <xs:annotation>
      <xs:documentation>
       Undocumented feature. This syntax is subject to future breaking changes.
      </xs:documentation>
    </xs:annotation>
    <xs:all>
      <xs:element name="Startup" minOccurs="0" maxOccurs="1" type="Startup"/>
      <xs:element name="Runtime" minOccurs="0" maxOccurs="1" type="RuntimeForRoleModule"/>
      <xs:element name="ConfigurationSettings" type="ConfigurationSettings" minOccurs="0" maxOccurs="1" />
      <xs:element name="Endpoints" type="Endpoints" minOccurs="0" maxOccurs="1"/>
      <xs:element name="LocalResources" type="LocalResources" minOccurs="0" maxOccurs="1" />
      <xs:element name="Certificates" type="Certificates" minOccurs="0" maxOccurs="1" />
    </xs:all>
    <xs:attribute name="namespace" type="NamedElementNameString" use="required" />
  </xs:complexType>
  
  <xs:element name="RoleModule" type="RoleModule" />
  <xs:element name="ServiceDefinition" type="ServiceDefinition"/>
</xs:schema>
